Bumping version

Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 4.1.0 to 4.3.0.
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](https://github.com/docker/setup-buildx-action/compare/d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5...37fe631027851001ddb9b187196cc803df7f5f0e)

---
updated-dependencies:
- dependency-name: docker/setup-buildx-action
  dependency-version: 4.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

.github/workflows/docker-githubaction.yml

@@ -24,7 +24,7 @@ jobs:
 
       - name: Set up Docker Buildx
         id: buildx
-        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
         with:
           version: latest
 

.github/workflows/docker-release.yml

@@ -28,7 +28,7 @@ jobs:
 
       - name: Set up Docker Buildx
         id: buildx
-        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
         with:
           version: latest
 

.github/workflows/release.yml

@@ -48,7 +48,7 @@ jobs:
       - name: Cross compile
         run: |
           sudo apt-get install rhash -y
-          go install github.com/goreleaser/goreleaser/v2@v2.16.0
+          go install github.com/goreleaser/goreleaser/v2@v2.17.1
           ./scripts/xcompile.sh
 
       - name: Sign checksums

Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.26.5@sha256:079e59808d2d252516e27e3f3a9c003740dee7f75e55aa71528766d52bcfc16a AS builder
+FROM golang:1.26.6@sha256:0d1d3a794be25f809dd2cb3160d8c73276c4056a9f8242a138e908ddeee7b6b6 AS builder
 
 WORKDIR /go/src/mikefarah/yq
 

Dockerfile.dev

@@ -1,4 +1,4 @@
-FROM golang:1.26.5@sha256:079e59808d2d252516e27e3f3a9c003740dee7f75e55aa71528766d52bcfc16a
+FROM golang:1.26.6@sha256:0d1d3a794be25f809dd2cb3160d8c73276c4056a9f8242a138e908ddeee7b6b6
 
 COPY scripts/devtools.sh /opt/devtools.sh
 

cmd/version.go

@@ -11,7 +11,7 @@ var (
 	GitDescribe string
 
 	// Version is main version number that is being run at the moment.
-	Version = "v4.53.3"
+	Version = "v4.53.6"
 
 	// VersionPrerelease is a pre-release marker for the version. If this is "" (empty string)
 	// then it means that it is a final release. Otherwise, this is a pre-release

go.mod

@@ -20,9 +20,9 @@ require (
 	github.com/yuin/gopher-lua v1.1.2
 	github.com/zclconf/go-cty v1.19.0
 	go.yaml.in/yaml/v4 v4.0.0-rc.6
-	golang.org/x/mod v0.38.0
-	golang.org/x/net v0.57.0
-	golang.org/x/text v0.40.0
+	golang.org/x/mod v0.40.0
+	golang.org/x/net v0.58.0
+	golang.org/x/text v0.41.0
 )
 
 require (
@@ -36,7 +36,7 @@ require (
 	github.com/mitchellh/go-wordwrap v1.0.1 // indirect
 	golang.org/x/sync v0.22.0 // indirect
 	golang.org/x/sys v0.47.0 // indirect
-	golang.org/x/tools v0.47.0 // indirect
+	golang.org/x/tools v0.49.0 // indirect
 )
 
 go 1.25.0

go.sum

@@ -72,19 +72,19 @@ github.com/zclconf/go-cty-debug v0.0.0-20240509010212-0d6042c53940/go.mod h1:CmB
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 go.yaml.in/yaml/v4 v4.0.0-rc.6 h1:1h7H1ohdUh93/FyE4YaDa1Zh64K6VVbjF4K6WUxMtH4=
 go.yaml.in/yaml/v4 v4.0.0-rc.6/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0=
-golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk=
-golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
+golang.org/x/mod v0.40.0 h1:hUv+3cXcdRHz08UmSiOob7sadHig73uo5bkXxQ/tvUs=
+golang.org/x/mod v0.40.0/go.mod h1:0/weTWkPWGBikyTWAX3dkjVztMmBA5hM0DH6BElSupE=
+golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
+golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
 golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
 golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
 golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
-golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
-golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
-golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
+golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
+golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
+golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI=
+golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c h1:dUUwHk2QECo/6vqA44rthZ8ie2QXMNeKRTHCNY2nXvo=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

pkg/yqlib/all_at_once_evaluator.go

@@ -49,12 +49,13 @@ func (e *allAtOnceEvaluator) EvaluateFiles(expression string, filenames []string
 
 	var allDocuments = list.New()
 	for _, filename := range filenames {
-		reader, err := readStream(filename)
+		reader, cleanup, err := readStream(filename)
 		if err != nil {
 			return err
 		}
 
 		fileDocuments, err := readDocuments(reader, filename, fileIndex, decoder)
+		cleanup()
 		if err != nil {
 			return err
 		}

pkg/yqlib/encoder_yaml.go

@@ -2,6 +2,7 @@ package yqlib
 
 import (
 	"bytes"
+	"fmt"
 	"io"
 	"strings"
 
@@ -49,23 +50,37 @@ func (ye *yamlEncoder) Encode(writer io.Writer, node *CandidateNode) error {
 		destination = tempBuffer
 	}
 
-	var encoder = yaml.NewEncoder(destination)
+	indent := ye.prefs.Indent
+	if indent < 2 {
+		indent = 2
+	} else if indent > 9 {
+		indent = 9
+	}
 
-	encoder.SetIndent(ye.prefs.Indent)
-	if ye.prefs.CompactSequenceIndent {
-		encoder.CompactSeqIndent()
+	dumper, err := yaml.NewDumper(destination,
+		yaml.WithV3Defaults(),
+		yaml.WithIndent(indent),
+		yaml.WithCompactSeqIndent(ye.prefs.CompactSequenceIndent),
+		yaml.WithLineWidth(-1),
+	)
+	if err != nil {
+		return fmt.Errorf("configure YAML encoding: %w", err)
 	}
 
 	target, err := node.MarshalYAML()
-
 	if err != nil {
+		_ = dumper.Close()
 		return err
 	}
 
 	trailingContent := target.FootComment
 	target.FootComment = ""
 
-	if err := encoder.Encode(target); err != nil {
+	err = dumper.Dump(target)
+	if closeErr := dumper.Close(); err == nil {
+		err = closeErr
+	}
+	if err != nil {
 		return err
 	}
 

pkg/yqlib/front_matter_test.go

@@ -136,10 +136,11 @@ Some content
 	test.AssertResult(t, originalFilename, resolved)
 
 	// Read documents using the temp file, verify they get the original filename
-	reader, err := readStream(tempFilename)
+	reader, cleanup, err := readStream(tempFilename)
 	if err != nil {
 		panic(err)
 	}
+	defer cleanup()
 	decoder := NewYamlDecoder(ConfiguredYamlPreferences)
 	docs, err := readDocuments(reader, tempFilename, 0, decoder)
 	if err != nil {

pkg/yqlib/operator_load_test.go

@@ -77,7 +77,7 @@ var loadScenarios = []expressionScenario{
 		document:       `{something: {file: "thing.yml"}, over: {here: [{file: "thing.yml"}]}}`,
 		expression:     `(.. | select(has("file"))) |= load("../../examples/" + .file)`,
 		expected: []string{
-			"D0, P[], (!!map)::{something: {a: apple is included, b: cool.}, over: {here: [{a: apple is included,\n                b: cool.}]}}\n",
+			"D0, P[], (!!map)::{something: {a: apple is included, b: cool.}, over: {here: [{a: apple is included, b: cool.}]}}\n",
 		},
 	},
 	{

pkg/yqlib/operator_multiply_test.go

@@ -83,7 +83,7 @@ var nodeWithFooter = `a: apple
 
 var document = `a: &cat {name: cat}
 b: {name: dog}
-c: 
+c:
   <<: *cat
 `
 
@@ -514,7 +514,7 @@ var multiplyOperatorScenarios = []expressionScenario{
 		environmentVariables: map[string]string{"originalPath": ".myArray", "otherPath": ".newArray", "idPath": ".a"},
 		expression:           mergeExpression,
 		expected: []string{
-			"D0, P[], (!!map)::{myArray: [{a: apple, b: appleB2}, {a: kiwi, b: kiwiB}, {a: banana, b: bananaB, c: bananaC},\n        {a: dingo, c: dingoC}], something: else}\n",
+			"D0, P[], (!!map)::{myArray: [{a: apple, b: appleB2}, {a: kiwi, b: kiwiB}, {a: banana, b: bananaB, c: bananaC}, {a: dingo, c: dingoC}], something: else}\n",
 		},
 	},
 	{

pkg/yqlib/operator_select_test.go

@@ -98,7 +98,7 @@ var selectOperatorScenarios = []expressionScenario{
 		document:    `[{animal: cat, legs: {cool: true}}, {animal: fish}]`,
 		expression:  `(.[] | select(.legs.cool == true).canWalk) = true | (.[] | .alive.things) = "yes"`,
 		expected: []string{
-			"D0, P[], (!!seq)::[{animal: cat, legs: {cool: true}, canWalk: true, alive: {things: yes}}, {animal: fish,\n        alive: {things: yes}}]\n",
+			"D0, P[], (!!seq)::[{animal: cat, legs: {cool: true}, canWalk: true, alive: {things: yes}}, {animal: fish, alive: {things: yes}}]\n",
 		},
 	},
 	{

pkg/yqlib/operator_sort_keys_test.go

@@ -37,7 +37,7 @@ var sortKeysOperatorScenarios = []expressionScenario{
 		document:       `{bParent: {c: dog, array: [3,1,2]}, aParent: {z: donkey, x: [{c: yum, b: delish}, {b: ew, a: apple}]}}`,
 		expression:     `sort_keys(..)`,
 		expected: []string{
-			"D0, P[], (!!map)::{aParent: {x: [{b: delish, c: yum}, {a: apple, b: ew}], z: donkey}, bParent: {array: [\n            3, 1, 2], c: dog}}\n",
+			"D0, P[], (!!map)::{aParent: {x: [{b: delish, c: yum}, {a: apple, b: ew}], z: donkey}, bParent: {array: [3, 1, 2], c: dog}}\n",
 		},
 	},
 }

pkg/yqlib/stream_evaluator.go

@@ -5,7 +5,6 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"os"
 )
 
 // A yaml expression evaluator that runs the expression multiple times for each given yaml document.
@@ -50,21 +49,17 @@ func (s *streamEvaluator) EvaluateFiles(expression string, filenames []string, p
 	}
 
 	for _, filename := range filenames {
-		reader, err := readStream(filename)
+		reader, cleanup, err := readStream(filename)
 
 		if err != nil {
 			return err
 		}
 		processedDocs, err := s.Evaluate(filename, reader, node, printer, decoder)
+		cleanup()
 		if err != nil {
 			return err
 		}
 		totalProcessDocs = totalProcessDocs + processedDocs
-
-		switch reader := reader.(type) {
-		case *os.File:
-			safelyCloseFile(reader)
-		}
 	}
 
 	if totalProcessDocs == 0 {

pkg/yqlib/utils.go

@@ -32,21 +32,20 @@ func resolveFilename(filename string) string {
 	return filename
 }
 
-func readStream(filename string) (io.Reader, error) {
-	var reader *bufio.Reader
+// readStream returns a reader for the given file, along with a cleanup function
+// that must be called once the reader is no longer needed. The cleanup is a no-op
+// for stdin.
+func readStream(filename string) (io.Reader, func(), error) {
 	if filename == "-" {
-		reader = bufio.NewReader(os.Stdin)
-	} else {
-		// ignore CWE-22 gosec issue - that's more targeted for http based apps that run in a public directory,
-		// and ensuring that it's not possible to give a path to a file outside that directory.
-		file, err := os.Open(filename) // #nosec
-		if err != nil {
-			return nil, err
-		}
-		reader = bufio.NewReader(file)
+		return bufio.NewReader(os.Stdin), func() {}, nil
 	}
-	return reader, nil
-
+	// ignore CWE-22 gosec issue - that's more targeted for http based apps that run in a public directory,
+	// and ensuring that it's not possible to give a path to a file outside that directory.
+	file, err := os.Open(filename) // #nosec
+	if err != nil {
+		return nil, nil, err
+	}
+	return bufio.NewReader(file), func() { safelyCloseFile(file) }, nil
 }
 
 func writeString(writer io.Writer, txt string) error {

pkg/yqlib/utils_test.go

@@ -4,11 +4,89 @@ import (
 	"bufio"
 	"bytes"
 	"io"
+	"os"
+	"path/filepath"
+	"runtime/debug"
+	"strconv"
 	"testing"
 
 	"github.com/mikefarah/yq/v4/test"
 )
 
+// countOpenFileDescriptors returns the number of file descriptors this process
+// currently holds open, or -1 if the platform does not expose them.
+func countOpenFileDescriptors() int {
+	for _, dir := range []string{"/proc/self/fd", "/dev/fd"} {
+		// Readdirnames avoids stat-ing each entry, which races with descriptors
+		// (including this directory handle) being closed underneath us.
+		handle, err := os.Open(dir)
+		if err != nil {
+			continue
+		}
+		names, err := handle.Readdirnames(-1)
+		safelyCloseFile(handle)
+		if err != nil {
+			continue
+		}
+		// discount the directory handle itself
+		return len(names) - 1
+	}
+	return -1
+}
+
+func writeSampleFiles(t *testing.T, count int) []string {
+	t.Helper()
+	dir := t.TempDir()
+	filenames := make([]string, count)
+	for i := 0; i < count; i++ {
+		filename := filepath.Join(dir, "sample-"+strconv.Itoa(i)+".yml")
+		if err := os.WriteFile(filename, []byte("a: apple\n"), 0600); err != nil {
+			t.Fatalf("failed to write sample file: %v", err)
+		}
+		filenames[i] = filename
+	}
+	return filenames
+}
+
+func discardingPrinter() Printer {
+	return NewPrinter(NewYamlEncoder(ConfiguredYamlPreferences), NewSinglePrinterWriter(bufio.NewWriter(io.Discard)))
+}
+
+func assertNoLeakedFileDescriptors(t *testing.T, evaluate func(filenames []string) error) {
+	t.Helper()
+	InitExpressionParser()
+
+	// os.File finalisers close leaked descriptors on collection, which would
+	// let a genuine leak pass unnoticed.
+	defer debug.SetGCPercent(debug.SetGCPercent(-1))
+
+	before := countOpenFileDescriptors()
+	if before < 0 {
+		t.Skip("file descriptors are not observable on this platform")
+	}
+
+	if err := evaluate(writeSampleFiles(t, 50)); err != nil {
+		t.Fatalf("failed to evaluate files: %v", err)
+	}
+
+	after := countOpenFileDescriptors()
+	if after > before {
+		t.Errorf("expected no additional open file descriptors, had %d before and %d after", before, after)
+	}
+}
+
+func TestStreamEvaluatorClosesInputFiles(t *testing.T) {
+	assertNoLeakedFileDescriptors(t, func(filenames []string) error {
+		return NewStreamEvaluator().EvaluateFiles(".a", filenames, discardingPrinter(), NewYamlDecoder(ConfiguredYamlPreferences))
+	})
+}
+
+func TestAllAtOnceEvaluatorClosesInputFiles(t *testing.T) {
+	assertNoLeakedFileDescriptors(t, func(filenames []string) error {
+		return NewAllAtOnceEvaluator().EvaluateFiles(".a", filenames, discardingPrinter(), NewYamlDecoder(ConfiguredYamlPreferences))
+	})
+}
+
 // plainWriter only implements io.Writer, so io.WriteString must fall back to Write.
 type plainWriter struct {
 	buf bytes.Buffer

pkg/yqlib/yaml_test.go

@@ -106,6 +106,12 @@ var yamlFormatScenarios = []formatScenario{
 		input:       "[1, 2]",
 		expected:    "[1, 2]\n",
 	},
+	{
+		description: "long line",
+		skipDoc:     true,
+		input:       "field: Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt",
+		expected:    "field: Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt\n",
+	},
 }
 
 var yamlParseScenarios = []expressionScenario{

release_notes.txt

@@ -1,3 +1,26 @@
+4.53.6:
+  - Fixing release build issue
+  
+4.53.5:
+  - Fixed line wrapping bug (#2824, #2823) Thanks mxey
+  - Bumped dependencies 
+
+4.53.4:
+- Close input files after processing each one (#2796) (#2808) Thanks @MsfPablo
+- Fixed non string HCL string keys (#2795)
+- Fixed heap allocation bug (#2809) Thanks @MsfPablo
+- Fix deleting commented empty list YAML output (#2765) Thanks @dpersek
+- Fix (has) return false for negative array indices (#2769) Thanks @maximilize
+- Fix (sort): avoid int64 overflow comparing large integers (#2771) Thanks @maximilize
+- Fix: preserve correct parent references in explode merge anchor reconstruction (#2730) Thanks @vomba
+- Improve Guard ExpressionParser initialization with sync.Once (#2789) Thanks @arcaven
+- Fix: reject negative indent instead of panicking (#2746) Thanks @StressTestor
+- Fix: parse signed hex and octal integers (#2749) Thanks @StressTestor
+- Fix: skip UTF-8 BOM when processing front matter (#2751) Thanks @StressTestor
+- Fix !!merge tag regression for yq  (#2705) Thanks @W-Floyd
+- Default to yaml when a file's extension is not a recognised format (#2785) Thanks @devthedevil
+- Bumped dependencies
+
 4.53.3:
   - Add `--ini-preserve-quotes` flag for INI round-trip quote preservation (#2728) Thanks @toller892!
   - Fix: reset INI decoder state on init (#2719) Thanks @xieby1!

scripts/xcompile.sh

@@ -2,7 +2,7 @@
 
 set -eo pipefail
 
-# You may need to go install github.com/goreleaser/goreleaser/v2@v2.16.0 first
+# You may need to go install github.com/goreleaser/goreleaser/v2@v2.17.1 first
 GORELEASER="goreleaser build --clean"
 if [ -z "$CI" ] || [[ "${GITHUB_REF_NAME:-}" == draft-* ]]; then
   GORELEASER+=" --snapshot"

snap/snapcraft.yaml

@@ -1,5 +1,5 @@
 name: yq
-version: 'v4.53.3'
+version: 'v4.53.6'
 summary: A lightweight and portable command-line data file processor
 description: |
   `yq` uses [jq](https://github.com/stedolan/jq) like syntax but works with yaml, json, xml, csv, properties and TOML files.
@@ -32,6 +32,6 @@ parts:
     build-environment:
       - CGO_ENABLED: 0
     source: https://github.com/mikefarah/yq.git
-    source-tag: v4.53.3
+    source-tag: v4.53.6
     build-snaps:
       - go/latest/stable